I'm trying to filter on some parts of the payload, for an IPv6 packet with extension headers (for instance Destination Options).
ip6tables works fine with conditions like
--proto udp or
109, even when the packet has extension headers. Netfilter clearly knows how to jump over Destination Options to
find the UDP header.
Now, I would like to use the u32 module to match a byte in the
payload (say "I want the third byte of the payload to be 42). If the packet has no extension headers something like
"48&0x0000ff00=0x2800"̀ (48 = 40 bytes for the IPv6 header + 8 for the UDP header) works fine, If the packet has a Destination Options, it no
longer matches. I would like to write a rule that will work whether
the packet has Destination Options or not.
I do not find a way to tell Netfilter to parse until the UDP header
(something that it is able to do, otherwise
109 would not work) then to leave u32 parse the rest.
I'm looking for a simple way, otherwise, as BatchyX mentions, I could write a kernel module doing what I want.